Car Parking 2017-18 City of York Council Internal Audit Report

Business Unit: Economy and Place Responsible Officer: AD, Transport, Highways & Environment Service Manager: Head of Transport, Parking & Major Transport Projects Date Issued: 4th September 2018 Status: Final Reference: 10610/004

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Reasonable Assurance | Summary and Overall Conclusions

Introduction The council is responsible for enforcing parking regulations within its area under the decriminalised parking scheme introduced by the Traffic Management Act 2004. Regulations cover both on-street parking (such as yellow line restrictions and residents’ priority parking zones) and council car parks. Drivers are issued with Penalty Charge Notices (PCNs) for any contravention of the regulations.

The council has 15 standard car parks, 6 park and ride sites and 61 areas that are residents’ parking zones with the council raising about £7m of car park income annually from them. The council also collects around £600k annually from PCNs that are issued across the city.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system will ensure that:

- All income that is received from car parks, PCNs and residents’ parking permits has been banked.
- The contract to take car parking payments by phone is working effectively.
- The appeals process for PCNs is being carried out effectively to ensure that the case is independently reviewed and an unbiased decision given.
- Strategic reviews are taken of the car parking service to ensure that parking charges are suitable and that enforcement actions are targeted.

Key Findings A previous audit of Car Parking in 2015/16 found that Parking Gateway was not being reconciled to FMS and an outstanding action in relation to this was still outstanding at the commencement of the audit. The audit found this was still the case, meaning that it is not possible to confirm whether all money that was due to be paid for parking permits and PCNs was actually being paid and therefore received. Parking Gateway could list that the permit or PCN had been paid when it was possible this was not the case because the system wasn't being reconciled to FMS.

The contract with Cobalt Telephone Technologies Ltd was generally working well except that Key Performance Indicators were not being provided by the contractor.

The appeals process which is used to determine when objections to PCNs are legitimate was reviewed and found to be working well. The process was based on guidelines from the Department for Transport and appeals are dealt with in an appropriate way. Cases were reviewed promptly by a person independent from the Enforcement Team with the vehicle owner being notified as to the reason behind the decision. The level of parking charges is set annually as part of the council's budget setting process. It is included as part of the fees and charges report that is presented to members alongside the annual budget setting report where the council's budget is agreed. Currently reliance is placed on the experience of enforcement officers to ensure areas and times are targeted for enforcement work. This knowledge is likely to be good and the added value a more complex system would provide should be weighed against the cost of procuring it.

**Overall Conclusions**

The arrangements for managing risk were satisfactory however some weaknesses were identified. An acceptable control environment is in operation but there are a number of improvements that could be made. Our overall opinion of the controls within the system at the time of the audit was that they provided Reasonable Assurance.

1. Reconciliations are not being done between Parking Gateway and FMS

| Issue/Control Weakness | Risk | |------------------------|------| | The Parking Gateway system isn't being reconciled to FMS. | PCNs or parking permits are listed as being paid on Parking Gateway even though no money has been received for them. |

Findings

The Parking Gateway system is still not being reconciled to FMS, therefore, while it is unlikely, there is a possibility that PCNs and Parking Permits could be written off or issued free of charge with Parking Gateway listing that payments were made in full. This issue was raised in the previous audit that was done during 2015/16 but it has not been resolved.

A report can now be run from the Parking Gateway system that shows all the transactions that were input onto the system each day. However, there is no report from FMS to compare the Parking Gateway report against nor has responsibility for doing this reconciliation been assigned to either the Car Parking or Finance teams who manage Parking Gateway and FMS respectively.

The service acknowledges the risk and, while it feels it is small and highly unlikely, it is accepted that the system, as with any other systems, could be vulnerable if there was an intended and determined attempt to work through the system to exploit any vulnerabilities to either cancel a PCN without due process or payment.

Agreed Action 1.1

It is recognised that a new ICT back office system should cover this issue and work is progressing to develop a specification with all affected services to ensure what York procures meets the current and future needs including an automated ability to reconcile against FMS.

A view needs to be agreed (with advice from Veritau as appropriate) as to who owns this risk, which is suggested could be either the Corporate Director for Economy and Place, the Economy and Place Finance Manager and/or Director of Customer and Corporate Services or a combination.

| Priority | 2 | |----------|---| | Responsible Officer | Head of Parking Services | | Timescale | 31st October 2018 | 2. Key Performance Indicators

| Issue/Control Weakness | Risk | |------------------------|------| | The contractor to provide electronic parking tickets is not providing Key Performance Indicators. | Poor performance may not be identified. |

Findings

The contract with Cobalt Technology Telephone Technologies Ltd to provide electronic parking tickets sets down six Key Performance Indicators that should be provided to the council. Although a monthly activity report is given to the council each month by the contractor, the Key Performance Indicators have not been provided to date.

Agreed Action 2.1

Key Performance Indicators (KPIs) are a part of the contract between the service provider (RingGo) and the council. However as advised by the council’s Procurement department, a settling in period was suggested. This period is now at an end and moving forward, the KPIs will be a standard agenda item at the council’s six weekly review meetings with the RingGo account manager.

The first of these meetings has taken place and the KPI’s have been assessed against RingGo’s performance where there was only a slight dip in system availability. This dropped to 96% from the agreed 99.5% in October 2017, however, this was due to a telecommunications issue with mobile phone operators and not the fault of RingGo.

In addition the number of complaints was displayed as 0%, however, these were queried as complaints have been sent through to RingGo to deal with. These are being reassessed by the RingGo account manager and a table will be resubmitted to Parking Services. It should be said that the majority of complaints were down to user error but these do feed into RingGo’s lessons learned to improve the system for customers.

In addition Parking Services receive a monthly performance report and made aware of any issues with the system as and when. To date there has been nothing significant other than what may be expected when a contract is settling in. 3. Upgrading the Parking Gateway system

| Issue/Control Weakness | Risk | |------------------------|------| | It is difficult to get meaningful data from the Parking Gateway system due to its limited functionality. | PCN enforcement work is not being targeted to areas and times where PCNs are issued meaning that the council loses out on PCN income. |

Findings

Parking Gateway records all the relevant information relating to PCNs which includes: the street and address of the offence, the traffic regulation that has been broken, the vehicle registration, the enforcement officer who issued the PCN and the date and time when the PCN was issued.

Although you can download information on each of these areas from Parking Gateway the data needs to be manipulated by the user and it is time consuming to produce more meaningful results. It is not possible to produce heat maps where PCNs are issued unless each PCN is plotted onto a map. Although it is possible to sort the data by street, it is not possible to compare this against neighbouring streets or if the street is very long. Comparing two or more data sets is difficult because it would involve lengthy data sorting exercises. This means it is not possible to identify area and time 'hot spots' for PCNs.

The enforcement officers, however, are very knowledgeable and it is questionable how much value increased statistical analysis would provide. Therefore consideration needs to be given to whether the costs of upgrading the Parking Gateway system outweigh the benefits of having better data available for PCN enforcement.

Agreed Action 3.1

Providing more meaningful data to support the deployment of Civil Enforcement Officers (CEOs) within the Parking Enforcement Service, such as heat maps, will ensure that the observations and knowledge of officers is evidenced. While officer’s experience goes a long way there will inevitably be areas that a new system could better identify. For example a concentrated number of hotline calls coming in for one area that may not have an appropriate level of enforcement. In addition this would provide better evidence to review the retention and recruitment of further CEOs depending on the demand and capacity we found across the city and its boundaries.

The above point is just one of a number of areas for improvement that a new back office system would provide covering a number of services and future proofing the Councils parking services and products.

The developing business case and specification is intended to ensure these and all other points are captured ensuring the right system is procured for the city's needs aiding in future proofing of the Council's Parking Services and products are realised and cost/benefits are achieved. Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |--------------------|------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.